# Flask and web framework
Flask[async]==3.1.3
Flask-SQLAlchemy==3.1.1
# Pin below 2.1: 2.1 makes plain postgresql:// URLs use psycopg (v3), but we
# ship psycopg2-binary. Unpinned, fresh builds crash on "No module named psycopg".
SQLAlchemy>=2.0.43,<2.1
Flask-Login==0.6.3
Flask-WTF==1.3.0
Flask-SocketIO==5.6.1
WTForms==3.2.2
Werkzeug==3.1.8

# OpenAI integration
# Latest 2.x — reasoning_effort is supported since 1.58, and the only 2.0
# breaking change was in the Responses API (ResponseFunctionToolCallOutputItem)
# which we don't use. chat.completions is unchanged.
openai>=2.48.0,<3.0.0
tiktoken==0.12.0
httpx[http2]==0.28.1

# Security and utilities
bcrypt==5.0.0
python-dotenv==1.2.2
requests==2.34.2
urllib3>=2.6.3  # Security fix for CVE-2024-37891
pre-commit==4.6.1
pydantic==2.13.4
Flask-Talisman==1.1.0
Flask-Limiter==4.1.1
Authlib==1.7.2
psutil==7.2.2
# >=2.40 needed for `enable_logs=True` kwarg on sentry_sdk.init()
sentry-sdk[flask]>=2.66.1,<3.0.0
regex==2026.6.28  # ReDoS-safe regex with timeout support

# Production WSGI
# gthread worker — compatible with Flask async routes + asgiref.AsyncToSync.
# See wsgi.py for the full rationale on why we ditched eventlet here.
gunicorn==26.0.0

# Database support
psycopg2-binary==2.9.12

# BeautifulSoup
beautifulsoup4==4.15.0

# Async support
asyncpg==0.31.0
